;; 腾讯云服务器


(use-modules
 (gnu)
 (gnu packages)
 (gnu packages bash)
 (gnu packages vpn)
 (gnu packages linux)
 (gnu packages shells)
 (gnu services base)
 (gnu services networking)
 (gnu services ssh)
 (gnu services sysctl)
 (gnu services web)
 (gnu services version-control)
 (gnu services virtualization)
 (luhux services compat)
 (luhux services vpn)
 )



(operating-system
 (host-name "tencent")
 (timezone "Hongkong")
 (locale "en_US.utf8")

 ;; 内核参数
 (kernel-arguments 
  (append
   (list
    ;; 显卡驱动会导致CPU100%
    "modprobe.blacklist=cirrus,cirrusfb"
    ;; ZSWAP设置    
    "zswap.enabled=1"
    "zswap.compressor=lz4"
    "zswap.zpool=z3fold"
    )
   %default-kernel-arguments
   )
  )

 ;; 内核附加模块
 ;; linux-5.7不需要树外的wireguard模块
; (kernel-loadable-modules (list wireguard-linux-compat))

 ;; 引导
 (bootloader (bootloader-configuration
	      (bootloader grub-bootloader)
	      (target "/dev/vda")))
 
 ;; 文件系统
 (file-systems (append (list (file-system
			       (device "/dev/vda1")
			       (mount-point "/boot")
			       (type "ext4"))
			     (file-system
			      (device "/dev/vda2")
			      (mount-point "/")
			      (type "btrfs")  
			      (options "compress-force=zstd:15"))  ;; 缓解磁盘不足
			     )
		       %base-file-systems))
 ;; swapfile
 (swap-devices '("/var/swapfiles/0"
		 "/var/swapfiles/1"))

 ;; 账户
 (users
  (append
   (list
    (user-account
     (name "dev")
     (comment "user")
     (group "users"))
    )
   %base-user-accounts))
 
 ;; 全局安装的包
 (packages
  (map
   specification->package
   (list
    ;; shell
    "bash"
    ;; 基础命令
    "coreutils"
    "findutils"
    "grep"
    "sed"
    "diffutils"
    "patch"
    "gawk"
    "util-linux-with-udev"

    ;; 归档
    "tar"

    ;; 压缩
    "gzip"
    "xz"
    "bzip2"

    ;; Linux 模块
    "kmod"

    ;; udev
    "eudev"
    
    ;; 用户管理
    "shadow"

    ;; 进程
    "psmisc"
    "procps"

    ;; 编辑器
    "vim"

    ;; 终端
    "kbd"

    ;; 分页
    "less"

    ;; 网络
    "inetutils"
    "isc-dhcp"
    "iproute2"
    "net-tools"
    
    ;; 终端复用器
    "tmux"

    ;; ssl证书
    "nss-certs"

    ;; bash 补全
    "bash-completion"

    ;; Wireguard VPN
    "wireguard-tools"

    ;; 文件系统
    "e2fsprogs"
    "btrfs-progs"
    )
   )
  )

 ;; 服务
 (services
  (list
   ;; 脚本兼容
   (service special-files-service-type
	    `(("/bin/sh" ,(file-append bash "/bin/sh"))
	      ("/usr/bin/env" ,(file-append coreutils "/bin/env"))))

   ;; tty 登录
   (service login-service-type)
   (service virtual-terminal-service-type)
   (service agetty-service-type (agetty-configuration
				 (extra-options '("-L"))
				 (term "vt100")
				 (tty #f)))
   (service mingetty-service-type (mingetty-configuration
				   (tty "tty1")))
   (service mingetty-service-type (mingetty-configuration
				   (tty "tty2")))
   (service mingetty-service-type (mingetty-configuration
				   (tty "tty3")))
   (service mingetty-service-type (mingetty-configuration
				   (tty "tty4")))
   (service mingetty-service-type (mingetty-configuration
				   (tty "tty5")))
   (service mingetty-service-type (mingetty-configuration
				   (tty "tty6")))
   
   ;; 随机数设备
   (service urandom-seed-service-type)

   ;; guix 服务
   (service guix-service-type
	    (guix-configuration
	     (substitute-urls (list
			       "http://127.0.0.1"
			       "https://mirror.guix.org.cn"
			       "https://ci.guix.gnu.org"
			       )
			      )
	     )
	    )

   ;; nscd 服务
   (service nscd-service-type)

   ;; udev
   (service udev-service-type)

   ;; log 记录服务
   (syslog-service)


   ;; 网络
   (service static-networking-service-type
	    (list (static-networking (interface "lo")
				     (ip "127.0.0.1")
				     (requirement '())
				     (provision '(loopback)))))
   (service dhcp-client-service-type)

   ;; ssh
   (service openssh-service-type
	    (openssh-configuration
	      (port-number 43921)
	      (permit-root-login #t)
	      (password-authentication? #f)
	      (public-key-authentication? #t)))

   ;; ntp
   (service openntpd-service-type)

   ;; nftables
   (service nftables-service-type
	    (nftables-configuration
	     (ruleset "/etc/nftables.rule")
	     )
	    )

   ;; guix publish服务
   (service guix-publish-service-type
	    (guix-publish-configuration
	     (port 8181)
	     (host "0.0.0.0")
	     (compression '(("lzip" 9)))
	     (cache "/var/cache/guix/publish")
	     (workers 2)
	     (ttl 2592000) ; 保留一月
	     )
	    )
  
   
   (service sysctl-service-type
	    (sysctl-configuration
	      (settings '(
			 ;; 流量轉發
			 ("net.ipv4.ip_forward" . "1")

			 ;; BBR
			 ("net.core.default_qdisc" . "fq")
			 ("net.ipv4.tcp_congestion_control" . "bbr")

			 ;; 禁用特权端口
			 ("net.ipv4.ip_unprivileged_port_start" . "0")
			 )
			)
	      )
	    )

   
   ;; git daemon
   (service git-daemon-service-type
	    (git-daemon-configuration
	     (export-all? #t)
	     (base-path "/srv/git")
	     (port 9418)
	     )
	    )

   ;; qemu
   ;; 为arm上的Guix服务
   (service qemu-binfmt-service-type
	    (qemu-binfmt-configuration
	     (platforms (lookup-qemu-platforms "arm" "aarch64"))
	     (guix-support? #t)
	     )
	    )

   ;; rc.local 兼容
   (service rclocal-service-type
	    (rclocal-configuration
	     (script "/etc/rc.local")))

   ;; Wireguard VPN (wg-quick)
   (service wireguard-quick-service-type
	    (wireguard-quick-configuration
	     (interface "tencent")))


   ;; Nginx
   (service nginx-service-type
	    (nginx-configuration
	     (server-blocks
	      (list
	       (nginx-server-configuration
		(server-name (list 'default))
		(listen '("80 default_server"))
		(locations (list (nginx-location-configuration
				  (uri "/")
				  (body '("proxy_pass https://guix-mirror.pengmeiyu.com;"
					  "proxy_ssl_server_name on;"
					  "proxy_ssl_name guix-mirror.pengmeiyu.com;"
					  "proxy_set_header Host guix-mirror.pengmeiyu.com;"					  
					  "proxy_cache guix-mirror;"
					  "proxy_cache_valid 200 60d;"
					  "proxy_cache_valid any 3m;"
					  "proxy_connect_timeout 60s;"
					  "proxy_ignore_client_abort on;"

					  "client_body_buffer_size 256k;"
					  "proxy_hide_header Set-Cookie;"
					  "proxy_ignore_headers Set-Cookie;"
					  "gzip off;")))))
		(raw-content '("access_log /var/log/nginx/guix-mirror.access.log;"
			       "error_log /var/log/nginx/guix-mirror.error.log;")
			     )
		)
	       )
	      )
	     (extra-content "
# cache for guix mirror
proxy_cache_path /var/cache/nginx/guix-mirror
    levels=2
    inactive=30d              # remove inactive keys after this period
    keys_zone=guix-mirror:8m  # about 8 thousand keys per megabyte
    max_size=40g;             # total cache data size
")
	     )
	    )
   )
  )
 )


